SQL Injection Affecting github.com/lf-edge/ekuiper/internal/pkg/store/sql package, versions <1.14.2
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.05% (21st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMLFEDGEEKUIPERINTERNALPKGSTORESQL-7725280
- published 21 Aug 2024
- disclosed 20 Aug 2024
- credit Yuan Luo, Shuai Xiong, Haoyu Wang
Introduced: 20 Aug 2024
CVE-2024-43406 Open this link in a new tabHow to fix?
Upgrade github.com/lf-edge/ekuiper/internal/pkg/store/sql to version 1.14.2 or higher.
Overview
Affected versions of this package are vulnerable to SQL Injection through the sqlKvStore process. An attacker can execute arbitrary SQL commands and manipulate or access unauthorized data by injecting malicious SQL code into the input parameters.